889 matches found
Moodle 'mod_assign_save_submission' function design vulnerability
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in the 'modassignsavesubmission' function in Moodle...
HackerOne: Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports
Hi Team, Legend ====== AppSecBounty = Bug ProgramSandbox Program Hacker1001 = Bug Reporter BugAdmin = Program Admin BugMember = Team Member associated ProgramManagement Group ProgramManagement Group = Custom Group created with "Program Management Permission" Steps: 1. Hacker1001 reports a Bug to...
Yahoo Touts Success of Bug Bounty Program
Yahoo established its formal bug bounty program nearly two years ago, and the company has paid out more than $1 million in rewards to researchers in that time. But security officials say the value the program has provided to the company has been just as great. Although Yahoo was among the latter...
MySQL Enterprise Monitor < 2.3.20 Apache Struts Predictable Token XSRF
According to its self-reported version, the MySQL Enterprise Monitor running on the remote host may be affected by a cross-site request forgery vulnerability due to the token generator failing to adequately randomize the token values. A remote attacker can exploit this by extracting a token from ...
[SECURITY] Fedora 22 Update: drupal7-webform-4.7-1.fc22
Webform is the module for making surveys in Drupal. After a submission, users may be sent an e-mail "receipt" as well as sending a notification to administrators. Results can be exported into Excel or other spreadsheet applications. Webform also provides some basic statistical review and has and...
WordPress Contact Form DB 2.8.29 Cross Site Request Forgery
Details ================ Software: Contact Form DB Version: 2.8.29 Homepage: https://wordpress.org/plugins/contact-form-7-to-database-extension/ Advisory report: https://security.dxw.com/advisories/csrf-in-contact-form-db-allows-attacker-to-delete-all-stored-form-submissions/ CVE: CVE-2015-1874...
WordPress Plugin Contact Form DB Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's suite of blogging platforms developed in the PHP language, which supports personal blog sites on PHP and MySQL servers.Contact Form DB also known as CFDB and contact-form-7-to-database-extension is one of the plugins that can submit the create and...
Facebook Bug Bounty Submissions Climb in 2014
Less than two months into the year and Facebook said it has already validated more than 100 submissions to its bug bounty, demonstrating a consistently growing interest in such programs industry wide. “Report volume is at its highest levels, and researchers are finding better bugs than ever...
CVE-2014-2224
CVE-2014-2224 affects Plogger 1.0 RC1 and earlier when the Lucid theme is used. The vulnerability arises because the system does not assign new values for certain codes, enabling remote attackers to bypass the CAPTCHA protection mechanism through a sequence of form submissions. The available sour...
Free Article Submissions 1.0 - SQL Injection
Exploit Title: Free Article Submissions SQL Injection Vulnerability Google Dork: inurl:/category.php?id=22 "Affiliate Programs Portal" inurl:/category.php?id=2 "Arts & Entertainment" Date: 07/12/2014 Exploit Author: BarrabravaZ Vendor Homepage: http://www.articlesetup.com/ Software Link: download...
CVE-2014-8596
Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the 1 submitid parameter in a 2 action to files/administration/submissions.php or 2 status parameter to files/administration/members.php...
PHP-Fusion 7.02.07 - SQL Injection
No description provided by source. Exploit Title: PHP-Fusion 7.02.07 SQL Injection Date: 06/11/2014 Exploit Author: Mauricio Correa Vendor Homepage: www.php-fusion.co.uk Software Link: http://ufpr.dl.sourceforge.net/project/php-fusion/PHP-Fusion%20Archives/7.x/ PHP-Fusion-7.02.07.zip Version:...
Facebook Releases osquery to Open Source
Facebook is in a giving mood today. The social networking giant announced today that it will release to open source a framework that detects and logs state changes in an operating system likely caused by an attack or performance meltdown. It also announced that it will hand out up to $300,000 nex...
Intelligence Insiders Disclose Bug Information With Tor
The executive director of the Tor Project told the BBC that U.S. and U.K. intelligence agencies are in an internal cat and mouse game, with one faction trying to break the anonymity network, and another one sharing bugs anonymously with Tor developers. Andrew Leman, in an extensive...
WordPress Resume Submissions & Job Postings 2.5.1 - Unrestricted File Upload
No description provided by source. Exploit Title: WordPress Resume Submissions & Job Postings v2.5.1 Unrestricted File Upload Date: 7/9/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.geerservices.com/ Software Link:...
PT-2014-4594 · Rock Lobster · Contact Form 7
Name of the Vulnerable Software and Affected Versions: Rock Lobster Contact Form 7 versions prior to 3.7.2 Description: The issue allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the wpcf7 captcha challenge captcha-719 parameter. This...
Google Bug Bounty Program to Include Chrome Extensions
Google has announced it will retool its bounty program and extend its scope to include Chrome apps and extensions branded as “by Google,” including extensions tied to popular products such as Gmail and Hangouts. According to a post by Google’s Michal Zalewski and Eduardo Vela Nava on the company’...
CVE-2013-4230
The mmwebform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrar...
CVE-2013-4230
The mmwebform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrar...